Log Action

Action Type: LOG

Records all detected security threats to the Monitor's internal logger while allowing the application to continue running normally.

Available for: All platforms (Mobile and Desktop)

How It Works

When the Log action is triggered, the Monitor framework:

Captures complete threat details including type, confidence, and metadata
Records the incident with timestamp and detection context
Stores logs persistently for later analysis
Continues application execution without interruption

When to Use

Recommended for:

Production applications that need to monitor threats without disrupting user experience
Building historical security data
Triggering alerts or notifications
Investigating incidents after the fact
Applications requiring comprehensive threat intelligence

Not recommended for:

Extremely sensitive applications where any threat should trigger termination
Real-time response scenarios where detection delays are unacceptable

Configuration

JSON Configuration

JSON

{
  "protections": [
    {
      "type": "MemoryDumpDetection",
      "action": "log",
      "interval": 2000
    },
    {
      "type": "DebuggerDetection",
      "action": "log",
      "interval": 1000
    }
  ]
}

{
  "protections": [
    {
      "type": "MemoryDumpDetection",
      "action": "log",
      "interval": 2000
    },
    {
      "type": "DebuggerDetection",
      "action": "log",
      "interval": 1000
    }
  ]
}

Code-Based Configuration (Kotlin)

Kotlin

import com.bytehide.monitor.Monitor
import com.bytehide.monitor.core.action.ActionType
import com.bytehide.monitor.core.protection.ProtectionModuleType

Monitor.configure { config ->
    config.addProtection(
        ProtectionModuleType.MEMORY_DUMP_DETECTION,
        ActionType.LOG,
        2000
    )

    config.addProtection(
        ProtectionModuleType.DEBUGGER_DETECTION,
        ActionType.LOG,
        1000
    )
}

import com.bytehide.monitor.Monitor
import com.bytehide.monitor.core.action.ActionType
import com.bytehide.monitor.core.protection.ProtectionModuleType

Monitor.configure { config ->
    config.addProtection(
        ProtectionModuleType.MEMORY_DUMP_DETECTION,
        ActionType.LOG,
        2000
    )

    config.addProtection(
        ProtectionModuleType.DEBUGGER_DETECTION,
        ActionType.LOG,
        1000
    )
}

Code-Based Configuration (Java)

Java

import com.bytehide.monitor.Monitor;
import com.bytehide.monitor.core.action.ActionType;
import com.bytehide.monitor.core.protection.ProtectionModuleType;

Monitor.configure(config -> {
    config.addProtection(
        ProtectionModuleType.MEMORY_DUMP_DETECTION,
        ActionType.LOG,
        2000
    );

    config.addProtection(
        ProtectionModuleType.DEBUGGER_DETECTION,
        ActionType.LOG,
        1000
    );
});

import com.bytehide.monitor.Monitor;
import com.bytehide.monitor.core.action.ActionType;
import com.bytehide.monitor.core.protection.ProtectionModuleType;

Monitor.configure(config -> {
    config.addProtection(
        ProtectionModuleType.MEMORY_DUMP_DETECTION,
        ActionType.LOG,
        2000
    );

    config.addProtection(
        ProtectionModuleType.DEBUGGER_DETECTION,
        ActionType.LOG,
        1000
    );
});

What Gets Logged

The Monitor logger records the following information for each threat:

Threat Type: Classification of the detected threat (e.g., DEBUGGER_ATTACHED, MEMORY_CORRUPTION)
Description: Human-readable explanation of the threat
Confidence Score: Numerical confidence (0.0-1.0) indicating certainty of detection
Timestamp: Precise moment the threat was detected
Module: Which protection module detected the threat
Metadata: Additional context (e.g., debugger name, injection method)

All logged incidents are reported to the Cloud Panel, where you can review them, set up alerts, and export data for analysis.

Interval Configuration

The intervalMs parameter controls checking frequency:

500-1000ms: High-frequency monitoring for critical modules
2000-3000ms: Standard monitoring with balanced overhead
5000ms+: Low-frequency background monitoring

For the Log action, shorter intervals are often acceptable since logging has minimal performance impact.

Best Practices

Always Log in Production: Use Log action as a safety net for all modules
Export Regularly: Periodically export threat logs for analysis and compliance
Set Alerts: Configure external systems to monitor logs and trigger alerts
Combine with Custom Actions: Use Custom actions on high-risk modules for more aggressive responses
Monitor Patterns: Look for repeated threats indicating targeted attacks
Maintain Log Hygiene: Review and archive old logs regularly